EstoniaGDPR Articles 82-83 and AKI Enforcement in Estonia
Regulation (EU) 2016/679, Arts. 82-83
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post AG, judgment of (Third Chamber) (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 71 of the Isikuandmete kaitse seadus (Personal Data Protection Act, IKS) applies only where the conduct does not meet the elements of Penal Code (karistusseadustik) Sections 157 and 157^1, and Section 72 likewise leaves those offences aside. Penal Code Section 157 punishes unlawful disclosure of personal data learned in professional or official activity by a person bound by a statutory duty of non-disclosure with a fine of up to 300 fine units, or up to EUR 32,000 for a legal person. Section 157^1(1) punishes unlawful disclosure of, or unlawful access to, special categories of personal data with a fine of up to 300 fine units, and Section 157^1(2) punishes the same act with a pecuniary punishment or imprisonment of up to one year where it is done for gain or causes harm to another person.
Penalty structure
Unusually among EU member states, Estonia's Isikuandmete kaitse seadus (Personal Data Protection Act, IKS) restates the GDPR Article 83 fine ceiling directly in its own text rather than relying solely on the Regulation's direct effect, and classifies the resulting penalty as an Estonian misdemeanour (vaartegu) rather than a separate administrative-fine category. Sections 66 to 70 each punish a distinct category of GDPR violation (data subject rights under Articles 12 to 22, unlawful transfer under Articles 44 to 49, violations of this Act's own processing bases, non-compliance with an Andmekaitse Inspektsioon (AKI) order under Article 58(2), and obstructing AKI access under Article 58(1)) with a fine of up to EUR 20,000,000, or, where the offender is a legal person, up to EUR 20,000,000 or 4 percent of its preceding financial year's worldwide annual turnover, whichever is greater, mirroring GDPR Article 83(5)-(6)'s own ceiling. Sections 71 and 72 set a much smaller residual misdemeanour fine, up to 200 fine units (approximately EUR 800), for unlawful personal-data access by an employee outside their duties, or any other data protection violation, that does not meet the elements of a Penal Code offence (see the criminal exposure note) or of Sections 62 to 71.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Andmekaitse Inspektsioon (AKI), Estonia's supervisory authority under the GDPR, which under IKS Section 73 is also the extrajudicial adjudicator (kohtuvaline menetleja) of the misdemeanours (vaarteod) IKS Chapter 6 (Sections 62 to 72) creates.
Enforcement record
The Inspectorate's own statistics table for 2025 counts 5 penal law fines for misdemeanours and coercive fines in supervisory cases (7 in 2024, 12 in 2023 and 2022, 10 in 2021) and 6 closed misdemeanour cases in 2025. The count mixes misdemeanour fines and coercive fines; it holds no private filings.
- As of
- Trend
- Falling
- Source link
- https://www.aki.ee/en/inspectorate-news-information-dpo-s/statistics
- Actions per year
- 5
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0300
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of (Third Chamber)
- Open questions
- Which Estonian rules on the extent of financial compensation apply to an award for non-material damage under Article 82(1), given that the Court of Justice in Case C-300/21 leaves that extent to the domestic rules of each Member State, subject to the principles of equivalence and effectiveness?
What it makes you log
Logging duty
Article 82 gives a right to compensation and Article 83 sets the conditions for administrative fines. Neither states a duty to create, keep or produce a log or record; the record of processing and breach documentation duties sit in Articles 30 and 33(5) of the Regulation.
- Kind
- None
- As of
What this law does
The Estonian Data Protection Inspectorate (AKI) is the supervisory authority. Under Section 73(2) of the Isikuandmete kaitse seadus (Personal Data Protection Act), AKI is the out-of-court authority (kohtuvaline menetleja) for the misdemeanors (vaartegu) that the Act's penalty provisions create.
Sections 65 to 67 punish infringements of the General Data Protection Regulation (GDPR) processing principles, the conditions for consent, the data subject rights in Articles 12 to 22 and the transfer rules in Articles 44 to 49 with a fine of up to EUR 20,000,000, or, for a legal person, up to EUR 20,000,000 or 4 percent of its preceding financial year's worldwide annual turnover, whichever is greater. The limitation period for these misdemeanors is three years under Section 73(1).
GDPR Article 82 gives any person who suffered material or non-material damage a right to compensation from the controller or processor.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .